<%#
 Copyright 2013-2025 the original author or authors from the JHipster project.

 This file is part of the JHipster project, see https://www.jhipster.tech/
 for more information.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at

      https://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-%>
package <%= packageName %>.web.rest;

<%_ if (authenticationTypeSession && !reactive) { _%>
import <%= packageName %>.domain.PersistentToken;
import <%= packageName %>.repository.PersistentTokenRepository;
<%_ } _%>
<%_ if (!reactive) { _%>
import <%= user.entityAbsoluteClass %>;
<%_ } _%>
import <%= packageName %>.repository.UserRepository;
import <%= packageName %>.security.SecurityUtils;
import <%= packageName %>.service.MailService;
import <%= packageName %>.service.UserService;
import <%= packageName %>.service.dto.PasswordChangeDTO;
import <%= packageName %>.service.dto.<%= user.adminUserDto %>;
import <%= packageName %>.web.rest.errors.*;
import <%= packageName %>.web.rest.vm.KeyAndPasswordVM;
import <%= packageName %>.web.rest.vm.ManagedUserVM;

import java.security.Principal;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
<%_ if (reactive) { _%>
import java.util.Objects;
import reactor.core.publisher.Mono;
<%_ } else { _%>
import java.util.*;
<%_ } _%>
import jakarta.validation.Valid;
<%_ if (authenticationTypeSession && !reactive) { _%>
import java.nio.charset.StandardCharsets;
import java.net.URLDecoder;
<%_ } _%>

/**
 * REST controller for managing the current user's account.
 */
@RestController
@RequestMapping("/api")
public class AccountResource {

    private static class AccountResourceException extends RuntimeException {
        private AccountResourceException(String message) {
            super(message);
        }
    }

    private static final Logger LOG = LoggerFactory.getLogger(AccountResource.class);

    private final UserRepository userRepository;

    private final UserService userService;

    private final MailService mailService;
  <%_ if (authenticationTypeSession && !reactive) { _%>

    private final PersistentTokenRepository persistentTokenRepository;
  <%_ } _%>

    public AccountResource(UserRepository userRepository, UserService userService, MailService mailService<% if (authenticationTypeSession && !reactive) { %>, PersistentTokenRepository persistentTokenRepository<% } %>) {

        this.userRepository = userRepository;
        this.userService = userService;
        this.mailService = mailService;
  <%_ if (authenticationTypeSession && !reactive) { _%>
        this.persistentTokenRepository = persistentTokenRepository;
  <%_ } _%>
    }

    /**
     * {@code POST  /register} : register the user.
     *
     * @param managedUserVM the managed user View Model.
     * @throws InvalidPasswordException {@code 400 (Bad Request)} if the password is incorrect.
     * @throws EmailAlreadyUsedException {@code 400 (Bad Request)} if the email is already used.
     * @throws LoginAlreadyUsedException {@code 400 (Bad Request)} if the login is already used.
     */
    @PostMapping("/register")
    @ResponseStatus(HttpStatus.CREATED)
    public <% if (reactive) { %>Mono<Void><% } else { %>void<% } %> registerAccount(@Valid @RequestBody ManagedUserVM managedUserVM) {
        if (isPasswordLengthInvalid(managedUserVM.getPassword())) {
            throw new InvalidPasswordException();
        }
  <%_ if (reactive) { _%>
        return userService.registerUser(managedUserVM, managedUserVM.getPassword())
            .doOnSuccess(mailService::sendActivationEmail)
            .then();
  <%_ } else { _%>
        <%= user.persistClass %> user = userService.registerUser(managedUserVM, managedUserVM.getPassword());
        mailService.sendActivationEmail(user);
  <%_ } _%>
    }

    /**
     * {@code GET  /activate} : activate the registered user.
     *
     * @param key the activation key.
     * @throws RuntimeException {@code 500 (Internal Server Error)} if the user couldn't be activated.
     */
    @GetMapping("/activate")
    public <% if (reactive) { %>Mono<Void><% } else { %>void<% } %> activateAccount(@RequestParam(value = "key") String key) {
  <%_ if (reactive) { _%>
        return userService.activateRegistration(key)
            .switchIfEmpty(Mono.error(new AccountResourceException("No user was found for this activation key")))
            .then();
  <%_ } else { _%>
        Optional<<%= user.persistClass %>> user = userService.activateRegistration(key);
        if (!user.isPresent()) {
            throw new AccountResourceException("No user was found for this activation key");
        }
  <%_ } _%>
    }

  <%_ if (!authenticationTypeJwt) { _%>
    /**
     * {@code GET  /authenticate} : check if the user is authenticated.
     *
     * @return the {@link ResponseEntity} with status {@code 204 (No Content)},
     * or with status {@code 401 (Unauthorized)} if not authenticated.
     */
    @GetMapping("/authenticate")
    public ResponseEntity<Void> isAuthenticated(Principal principal) {
        LOG.debug("REST request to check if the current user is authenticated");
        return ResponseEntity.status(principal == null ? HttpStatus.UNAUTHORIZED : HttpStatus.NO_CONTENT).build();
    }

  <%_ } _%>
    /**
     * {@code GET  /account} : get the current user.
     *
     * @return the current user.
     * @throws RuntimeException {@code 500 (Internal Server Error)} if the user couldn't be returned.
     */
    @GetMapping("/account")
    public <%- wrapMono(user.adminUserDto) %> getAccount() {
        return userService.getUserWithAuthorities()
            .map(<%= user.adminUserDto %>::new)
  <%_ if (reactive) { _%>
            .switchIfEmpty(Mono.error(new AccountResourceException("User could not be found")));
  <%_ } else { _%>
            .orElseThrow(() -> new AccountResourceException("User could not be found"));
  <%_ } _%>
    }

    /**
     * {@code POST  /account} : update the current user information.
     *
     * @param userDTO the current user information.
     * @throws EmailAlreadyUsedException {@code 400 (Bad Request)} if the email is already used.
     * @throws RuntimeException {@code 500 (Internal Server Error)} if the user login wasn't found.
     */
    @PostMapping("/account")
  <%_ if (reactive) { _%>
    public Mono<Void> saveAccount(@Valid @RequestBody <%= user.adminUserDto %> userDTO) {
        return SecurityUtils.getCurrentUserLogin()
            .switchIfEmpty(Mono.error(new AccountResourceException("Current user login not found")))
            .flatMap(userLogin -> userRepository.findOneByEmailIgnoreCase(userDTO.getEmail())
                .filter(existingUser -> !existingUser.getLogin().equalsIgnoreCase(userLogin))
                .hasElement()
                .flatMap(emailExists -> {
                    if (emailExists) {
                        throw new EmailAlreadyUsedException();
                    }
                    return userRepository.findOneByLogin(userLogin);
                }))
                .switchIfEmpty(Mono.error(new AccountResourceException("User could not be found")))
                .flatMap(user -> userService.updateUser(userDTO.getFirstName(), userDTO.getLastName(), userDTO.getEmail(),
                    userDTO.getLangKey()<% if (user.hasImageField) { %>, userDTO.getImageUrl()<% } %>));
  <%_ } else { _%>
    public void saveAccount(@Valid @RequestBody <%= user.adminUserDto %> userDTO) {
        String userLogin = SecurityUtils.getCurrentUserLogin().orElseThrow(() -> new AccountResourceException("Current user login not found"));
        Optional<<%= user.persistClass %>> existingUser = userRepository.findOneByEmailIgnoreCase(userDTO.getEmail());
        if (existingUser.isPresent() && (!existingUser.orElseThrow().getLogin().equalsIgnoreCase(userLogin))) {
            throw new EmailAlreadyUsedException();
        }
        Optional<<%= user.persistClass %>> user = userRepository.findOneByLogin(userLogin);
        if (!user.isPresent()) {
            throw new AccountResourceException("User could not be found");
        }
        userService.updateUser(userDTO.getFirstName(), userDTO.getLastName(), userDTO.getEmail(),
            userDTO.getLangKey()<% if (user.hasImageField) { %>, userDTO.getImageUrl()<% } %>);
  <%_ } _%>
    }

    /**
     * {@code POST  /account/change-password} : changes the current user's password.
     *
     * @param passwordChangeDto current and new password.
     * @throws InvalidPasswordException {@code 400 (Bad Request)} if the new password is incorrect.
     */
    @PostMapping(path = "/account/change-password")
    public <% if (reactive) { %>Mono<Void><% } else { %>void<% } %> changePassword(@RequestBody PasswordChangeDTO passwordChangeDto) {
        if (isPasswordLengthInvalid(passwordChangeDto.getNewPassword())) {
            throw new InvalidPasswordException();
        }
        <% if (reactive) { %>return <% } %>userService.changePassword(passwordChangeDto.getCurrentPassword(), passwordChangeDto.getNewPassword());
    }
  <%_ if (authenticationTypeSession && !reactive) { _%>

    /**
     * {@code GET  /account/sessions} : get the current open sessions.
     *
     * @return the current open sessions.
     * @throws RuntimeException {@code 500 (Internal Server Error)} if the current open sessions couldn't be retrieved.
     */
    @GetMapping("/account/sessions")
    public List<PersistentToken> getCurrentSessions() {
        return persistentTokenRepository.findByUser(
            userRepository
                .findOneByLogin(
                    SecurityUtils.getCurrentUserLogin().orElseThrow(() -> new AccountResourceException("Current user login not found"))
                )
                .orElseThrow(() -> new AccountResourceException("User could not be found"))
        );
    }

    /**
     * {@code DELETE  /account/sessions?series={series}} : invalidate an existing session.
     *
     * - You can only delete your own sessions, not any other user's session
     * - If you delete one of your existing sessions, and that you are currently logged in on that session, you will
     *   still be able to use that session, until you quit your browser: it does not work in real time (there is
     *   no API for that), it only removes the "remember me" cookie
     * - This is also true if you invalidate your current session: you will still be able to use it until you close
     *   your browser or that the session times out. But automatic login (the "remember me" cookie) will not work
     *   anymore.
     *   There is an API to invalidate the current session, but there is no API to check which session uses which
     *   cookie.
     *
     * @param series the series of an existing session.
     * @throws IllegalArgumentException if the series couldn't be URL decoded.
     */
    @DeleteMapping("/account/sessions/{series}")
    public void invalidateSession(@PathVariable("series") String series) {
        String decodedSeries = URLDecoder.decode(series, StandardCharsets.UTF_8);
        SecurityUtils.getCurrentUserLogin()
            .flatMap(userRepository::findOneByLogin)
            .ifPresent(u ->
                persistentTokenRepository.findByUser(u).stream()
                    .filter(persistentToken -> StringUtils.equals(persistentToken.getSeries(), decodedSeries))
    <%_ if (databaseTypeSql || databaseTypeMongodb) { _%>
                    .findAny().ifPresent(t -> persistentTokenRepository.deleteById(decodedSeries)));
    <%_ } else if (databaseTypeCouchbase) { _%>
                    .findAny().ifPresent(t -> persistentTokenRepository.deleteBySeries(decodedSeries)));
    <%_ } else { _%>
                    .findAny().ifPresent(persistentTokenRepository::delete));
    <%_ } _%>
    }
  <%_ } _%>

    /**
     * {@code POST   /account/reset-password/init} : Send an email to reset the password of the user.
     *
     * @param mail the mail of the user.
     */
    @PostMapping(path = "/account/reset-password/init")
  <%_ if (reactive) { _%>
    public Mono<Void> requestPasswordReset(@RequestBody String mail) {
        return userService
            .requestPasswordReset(mail)
            .doOnSuccess(user -> {
                if (Objects.nonNull(user)) {
                    mailService.sendPasswordResetMail(user);
                } else {
                    // Pretend the request has been successful to prevent checking which emails really exist
                    // but log that an invalid attempt has been made
                    LOG.warn("Password reset requested for non existing mail");
                }
            })
            .then();
  <%_ } else { _%>
    public void requestPasswordReset(@RequestBody String mail) {
        Optional<<%= user.persistClass %>> user = userService.requestPasswordReset(mail);
        if (user.isPresent()) {
            mailService.sendPasswordResetMail(user.orElseThrow());
        } else {
            // Pretend the request has been successful to prevent checking which emails really exist
            // but log that an invalid attempt has been made
            LOG.warn("Password reset requested for non existing mail");
        }
  <%_ } _%>
    }

    /**
     * {@code POST   /account/reset-password/finish} : Finish to reset the password of the user.
     *
     * @param keyAndPassword the generated key and the new password.
     * @throws InvalidPasswordException {@code 400 (Bad Request)} if the password is incorrect.
     * @throws RuntimeException {@code 500 (Internal Server Error)} if the password could not be reset.
     */
    @PostMapping(path = "/account/reset-password/finish")
    public <% if (reactive) { %>Mono<Void><% } else { %>void<% } %> finishPasswordReset(@RequestBody KeyAndPasswordVM keyAndPassword) {
        if (isPasswordLengthInvalid(keyAndPassword.getNewPassword())) {
            throw new InvalidPasswordException();
        }
  <%_ if (reactive) { _%>
        return userService.completePasswordReset(keyAndPassword.getNewPassword(), keyAndPassword.getKey())
            .switchIfEmpty(Mono.error(new AccountResourceException("No user was found for this reset key")))
            .then();
  <%_ } else { _%>
        Optional<<%= user.persistClass %>> user =
            userService.completePasswordReset(keyAndPassword.getNewPassword(), keyAndPassword.getKey());

        if (!user.isPresent()) {
            throw new AccountResourceException("No user was found for this reset key");
        }
  <%_ } _%>
    }

    private static boolean isPasswordLengthInvalid(String password) {
        return (
            StringUtils.isEmpty(password) ||
            password.length() < ManagedUserVM.PASSWORD_MIN_LENGTH ||
            password.length() > ManagedUserVM.PASSWORD_MAX_LENGTH
        );
    }
}
